Debian Security Advisory

DLA-89-1 nss -- LTS security update

Date Reported:
22 Nov 2014
Affected Packages:
nss
Vulnerable:
Yes
Security database references:
In Mitre's CVE dictionary: CVE-2014-1544.
More information:

In nss, a set of libraries designed to support cross-platform development of security-enabled client and server applications, Tyson Smith and Jesse Schwartzentruber discovered a use-after-free vulnerability that allows remote attackers to execute arbitrary code by triggering the improper removal of an NSSCertificate structure from a trust domain.

For Debian 6 Squeeze, these issues have been fixed in nss version 3.12.8-1+squeeze10